CVE-2026-126495
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.